2024-05-28상세분석보고서네이버로위장한피싱공격.pdf (1 MB)

Hauri reports a phishing campaign impersonating Naver login pages to steal credentials from Korean users through email distribution. The phishing site checked submitted credentials against naver.com to verify whether the victim had entered valid account information. When login succeeded, the site also requested a password change, a deception step intended to reduce suspicion that the page was fraudulent. The source says Kimsuky is suspected behind the activity and notes the group has previously impersonated Korean platforms such as Kakao and Naver.